Tuesday, May 3, 2011

Ding dong the witch is dead!

It has been an interesting couple of days with the death of Osama bin Laden, both in the senses of the impact this will have militarily for both al-Qaeda (weakening effect) and the U.S. military (strengthening), the effects it will have on international relationships as the U.S. invaded a sovereign nation that was harboring terrorist leaders, the break down of intelligence and counter intelligence operations that went on here (simply stated there are a lot of things us civilians just aren't going to know), and the impact this even had on the ITSEC (IT Security) and INFO-SEC (Information Security) world. That's right, I said this has an impact in the IT and INFO-SEC community. Before diving in, I must give a hearty congrats to the U.S. Navy Seals that went in there and got the dirty deed done. Props also fly to the CIA and other intelligence agencies involved, as I know they were monitoring Osama's place of residence for some time now (good chance to collect intel). The intelligence community also gets a hearty heap of props for acting quickly in killing Osama quickly after an intelligence breach on where Osama was hiding... I'll get into that later. Lastly, props fly to Obama for making the call to leave Pakistan out of the loop on this one and just have the Seal's take care of business. That sir took a huge pair of brass clankers when it comes to international politics.

Now, with props and congrats aside, lets take a look at why the U.S. government, their military, and intelligence communities acted so quickly last week to take Osama out. To be honest, if you're into intelligence and information gathering, leaving Osama alone would have been the best option here due to the complicated nature of the terrorist network he was figurehead of. Why kill an intelligence source when you can monitor it for as long as possible and maybe take out more of the problem? Here's the reason why: *clicky!*  About a week ago (April 24, 2011), WikiLeaks came into the picture releasing documents again... this time about Gitmo's detainee's, their documented confessions, and trying to draw skepticism about these confessions as they were obtained under torture -

The memos are signed by the commander of Guantánamo at the time, and describe whether the prisoners in question are regarded as low, medium or high risk. Although they were obviously not conclusive in and of themselves, as final decisions about the disposition of prisoners were taken at a higher level, they represent not only the opinions of JTF-GTMO, but also the Criminal Investigation Task Force, created by the Department of Defense to conduct interrogations in the "War on Terror," and the BSCTs, the behavioral science teams consisting of psychologists who had a major say in the "exploitation" of prisoners in interrogation.

Crucially, the files also contain detailed explanations of the supposed intelligence used to justify the prisoners' detention. For many readers, these will be the most fascinating sections of the documents, as they seem to offer an extraordinary insight into the workings of US intelligence, but although many of the documents appear to promise proof of prisoners' association with al-Qaeda or other terrorist organizations, extreme caution is required.

The documents draw on the testimony of witnesses -- in most cases, the prisoners' fellow prisoners -- whose words are unreliable, either because they were subjected to torture or other forms of coercion (sometimes not in Guantánamo, but in secret prisons run by the CIA), or because they provided false statements to secure better treatment in Guantánamo.
Source: http://wikileaks.ch/gitmo/ 

So what was in these leaked classified documents? Nothing much, <sarcasm>just the fact that Osama had moved to and was operating somewhere out of Abbottabad or Peshawar Pakistan as of 2008!</sarcasm> (source: here) This means the U.S. intelligence communities KNEW he was in those areas and actively looking for him. In fact, they were even closely monitoring this place in August of 2010. (source: here, read - there were probably feet on the ground collecting intel at this time)   That shoots a couple of holes in the theory that these interrogations "are unreliable, either because they were subjected to torture or other forms of coercion (sometimes not in Guantánamo, but in secret prisons run by the CIA), or because they provided false statements to secure better treatment in Guantánamo." This also helps to explain why the U.S. acted in killing Osama bin Laden somtime in the week prior to May 1, 2011. They were in a race to make sure WikiLeaks April 24, 2011 broadcast didn't send Osama hiding somewhere else.

Congrats now fly out to Wikileaks... congrats for throwing the following on your curriculum vitae -  "nearly warned a mass murdering psychopath of impending doom," disrupting an intelligence gathering operation into a radical Muslim group where we probably could have caught/killed more of these mass murdering psycho's, and for forcing the U.S. hand into early action when WE finally had a good chance to get a look into his terrorist organization. I guess when Assange stated WikiLeak's was going have "blood on [its] hands" (source: here) he really meant it. This time, you can rest assured that blood is one of someone who is far from innocent. You can also rest assured that by disrupting what was probably a full scale intelligence gathering operation, you probably got the blood of any further innocent people these terrorists kill on YOUR hands. After all, the U.S. intelligence community had a deeper chance to look into this terrorist group since August of 2010. Again, congrats WikiLeaks. You're starting to remind me of the phrasing from the movie the Watchmen: Who watches the watchmen? Who monitors you for damage assessment when it has the potential to impact innocent lives? Sure, club Gitmo has some issues, but drastic times call for drastic measures.

WikiLeak's drastic measure let some mass murderers escape justice more than likely. As of today, it looks like the Seals recovered some of Osama's computers and flash drives... so we can hope and pray that it is a wealth of intelligence showing which countries aided Osama bin Laden's terror network and where his terrorist buddies are hiding. Until then, U.S. Intelligence, it's time to strengthen up the security to prevent these breaches as this is just another equivalent of cyber-warfare (you can call WikiLeaks the PSYOP version of it). Stuff like this shouldn't have gotten out, and the standard ITSEC and INFO-SEC being employed by our government seems to be failing.   





Sunday, April 10, 2011

zonensuk.cc

Time for my last post regarding the list of nameservers I gave in my first blog post. Today we look at zonensuk.cc, another Russian Business Network (RBN) domain being used as a name server to perpetrate acts of fraud and malware dispersal. Our confirmation that this is an RBN domain/name server comes from Emerging Threat's RBN IP list. A quick google search on zonensuk.cc shows plenty of malware and fraud activity, so lets dive right in -
Domain Name: ZONENSUK.CC
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com
Name Server: NS1.ZONENSUK.CC
Name Server: NS2.ZONENSUK.CC
Name Server: NS3.ZONENSUK.CC
Status: CLIENT-XFER-PROHIBITED
Status: CLIENT-DELETE-PROHIBITED
Updated Date: 08-dec-2010
Creation Date: 08-dec-2010
Expiration Date: 08-dec-2011
Registrant Contact:
   Olga Veresova
   Olga Veresova rooms@ppmail.ru
   +78123274547 fax: +78123274547
   ul.Komsomola d.13 kv.26
   Sankt-Peterburg Sankt-Peterburg 195009
   RU
Source: centralops.net
What a surprise, googling Olga's street address I see plenty of hits for fake pharmacy and sofware websites... but the shocker is google leads me right back to my very own blog spot here to the post about FOLOWDNS.CC (another domain with falsified whois information being used by the RBN for their cyber crime). Boom! This proves zonensuk.cc has intentionally falsified registrant information for criminal intent in one blow. Let's throw some more stones through this glass house though -
Domain name: trvlftnow.com
Registrant Contact:
   Vladimir Silyanov
   Vladimir Silyanov epic@ca4.ru
   +78123274547 fax: +78123274547
   ul.Rudneva d.3 k.2 kv.119
   Sankt-Peterburg Sankt-Peterburg 194291
   RU
Created: 2011-03-15
Expires: 2012-03-15
Same phone number that zonensuk.cc, however it's a way different registrant name and address. This proves falsified whois registrant information. We see the same thing here for a fake phramacy... again same phone number but entirely different whois registrant address and name. So, with intentionally falsified whois registrant information for zonensuk.cc shown above, lets show what zonensuk.cc is being used for as a name server with a quick google search -

Fraud:
Link here (too long)
Link here (too long)
http://scamfraudalert.wordpress.com/2011/01/12/avon-products-plc-journey-financial-cc/
http://ddanchev.blogspot.com/2011/01/keeping-money-mule-recruiters-on-short.html
http://www.fraudwatchers.org/forums/showthread.php?p=127376

Malware:
http://support.clean-mx.de/clean-mx/viruses.php?domain=online-solutionsllc.cc&sort=first%20desc
http://support.clean-mx.de/clean-mx/viruses.php?domain=pegasltdunion.cc&sort=email%20desc

Again, there were plenty of other hits for malware and fraud activity on zonensuk.cc, a domain being used as a name server to spread malware and fraud. BizCN, again, just delete these registrants I've been mentoning in my blog posts entirely from your registry. These customers will only bring a business like yours problems in the long run with the amounts of falsified whois registrations they shell out for criminal intent.

uknsspace.cc

Continuing down the list of name servers from my first blog post, let's analyze uknsspace.cc. This is another Russian Business Network (RBN) domain being used for a nameserver to promote both fraud an malware according to Emerging Threat's RBN IP list. A quick google search on uknsspace.cc shows this domain's use in spreading malware and acts of fraud as a name server, so lets dive right in -

Domain Name: UKNSSPACE.CC
Registrar: BIZCN.COM, INC.
Whois Server: whois.bizcn.com
Referral URL: http://www.bizcn.com
Name Server: NS1.UKNSSPACE.CC
Name Server: NS2.UKNSSPACE.CC
Name Server: NS3.UKNSSPACE.CC
Status: CLIENT-XFER-PROHIBITED
Status: CLIENT-DELETE-PROHIBITED
Updated Date: 08-dec-2010
Creation Date: 08-dec-2010
Expiration Date: 08-dec-2011
Domain name: uknsspace.cc

Registrant Contact:
   Ninel Popakina
   Ninel Popakina gravy@ca4.ru
   +73842523612 fax: +73842523612
   ul.Suvorova d.2 kv.59
   Tashtagol Kemerovskaya oblast 652990 RU

Source: centralops.net   
Ninel, another Russian with faked whois registrant information serving up nothing but the RBN's finest forms of fraud and malware. Proving the whois registrant details falsified on this one actually wasn't that hard. Take "Ninel's" phone number and google it (with "-Ninel), and you get this -

WHOIS для kuzbass.net:
Registrant:

Join-stock company Electrosvyaz
   Oktyabrsky 10
   Kemerovo 650066
   RU

   Domain Name: KUZBASS.NET

   Administrative Contact:
      Alexander, Berdnikov           
      Joint-stock company Electrosvyaz
      Oktyabrsky 10
      Kemerovo 650066
      RU
      +73842523612 fax: +73842524310
Source: http://www.rutag.net/site/kuzbass.net (click whois tab)
Look at that! A company that uses the same phone number! Centralops.net shows that kuzbass.net was registered in April of 1997 and has a registration period set until April of 2014. This makes kuzbass.net sound like a legitimate site, and it is (it's a Telecom company). That said, this proves hands down that the whois registrant information for uknsspace.cc has been intentionally falsified. It uses the same phone number as kuzbass, but the registrant information such as address and registrant name are totally different! Let's show why the whois on uknsspace.cc has been intentionally falsified for criminal purposes with a quick search -


Fraud: 
http://scamfraudalert.wordpress.com/2010/12/19/whois-ns1-nnsque-cc/
http://scamfraudalert.wordpress.com/2011/01/12/avon-products-plc-journey-financial-cc/
Link here (too long)
http://ddanchev.blogspot.com/2011/01/keeping-money-mule-recruiters-on-short.html
http://www.delphifaq.com/faq/scams/f1057.shtml?p=68
http://www.fraudwatchers.org/forums/showthread.php?p=127376


Malware: 
Link here (too long)
Link here (too long)


There were quite a few other hits for criminal activity the domain/name server uknsspace.cc, however this is (point in case) an RBN name server with intentionally falsified whois information for the sole purposes of cyber criminal activity. BizCN, this is another one that needs to go down. In fact, I would just kill any sites you registered from the very same registrant of uknsspace.cc. They're just going to provide headaches in the long run.

Saturday, April 9, 2011

ukdns.cc

Moving on to some information from my first blog post, time to take a look at the domain ukdns.cc. This domain is being used as a name server by the Russian Business Network (RBN) according to Emerging Threat's RBN IP List and the research I did in my first blog post. A quick google search on ukdns.cc shows a lot of hits for cyber criminal activity ranging from malware to fraud. No shock there, this is the multifaceted cyber-criminal friendly RBN... so lets dive right in to ukdns.cc -

Domain Name: UKDNS.CC
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.UKDNS.CC
Name Server: NS2.UKDNS.CC
Name Server: NS3.UKDNS.CC
Status: CLIENT-XFER-PROHIBITED
Updated Date: 08-dec-2010
Creation Date: 08-dec-2010
Expiration Date: 08-dec-2011
Registrant Contact:
   Maksim Artemiev
   Maksim Artemiev ()
   
   Fax: 
   ul.Belorechenskaya d.13 k.1 kv.124
   Moscow, Moscow 109559
   RU

Administrative Contact:
   Maksim Artemiev
   Maksim Artemiev (append@free-id.ru)
   +7.4959385996
   Fax: +7.4959385996
   ul.Belorechenskaya d.13 k.1 kv.124
   Moscow, Moscow 109559
   RU
Source: centralops.net
A google search on Maksim's street address shows some hits for other domains he's register, among those quite a few fake pharmacies. This would show Maksim is no stranger to cyber-crime, meaning that the whois registrant information for the domain/nameserver ukdns.cc is definitely falsified. However lets prove it. Lets google his phone number (+7.4959385996 with "-Maksim"). Upon doing so, we come up with the following information -
Registrant:
Alexey Komarov domendiplomy@googlemail.com +7.4959385996
Alexey Komarov
Teply Stan str. d.21 kv.251
Moscow,Moscow,RU 117133
Domain Name:diplomy.com
Record last updated at 2009-07-13 05:59:00
Record created on 2004/9/22
Record expired on 2010/9/22
Source: http://www.webtrafficagents.com/Whois/diplomy.com
This site has been registered nearly 6 years! That would suggest diplomy.com is legitimate... and it would be hard to tell as diplomy.com is written in Russian. Thank God for google translate though (insert cynical laugh here, English version of diplomay.com here). What's do we find on diplomay.com? It's a site for counterfeiting fake documents! Looks like Alex's site isn't that legitimate and he uses the same phone number that "Maksim" used to register ukdns.cc. They both have different names and addresses though, showing that this is hands down, legitimately and intentionally falsified whois registrant information on ukdns.cc. We also find "Alex" registering a fake phramacy here (also another fresh one here) and another site for dispersing malware here. It looks like Alex and Maksim ARE in the same business after all!

So, this definitely proves beyond a shadow of a doubt the whois registrant information for ukdns.cc has been intentionally falsified for criminal purposes. Now lets show how this domain/name server is being used by the RBN to host their wonderful sites with a quick google search -

Fraud:
link here (too long)
http://scamfraudalert.wordpress.com/2011/01/12/avon-products-plc-journey-financial-cc/
http://ddanchev.blogspot.com/2011/01/keeping-money-mule-recruiters-on-short.html

Malware:
link here (too long)
link here (too long)
http://amada.abuse.ch/?search=lilac-antique.cc
http://amada.abuse.ch/?search=west-view-art.cc

There were plenty of other hits for fraud and malware being dished up by the RBN via their usage of the domain ukdns.cc as a name server. However, point in case is we have sufficiently proven the whois information on ukdns.cc has been intentionally falsified for criminal purposes. Enom, I would suggest you look at the registrant information I gave in this blog post thoroughly. Go through your registry, find any sites you registered for the "Alexey Komarov" OR "Maksim Artemiev" talked about here, and just place those domains on client hold. This has to be the fourth time you've come up in my blog spot, as I tied in this same cyber crime gang/fraud ring to other domains you've helped register: AUSTDEC.CC, OLIVAU.CC, & pageredns.cc

Time to clean up house Enom.

Friday, April 8, 2011

ringtons.cc

Continuing down the name server analysis as a recap to my first blog post, time to look at ringtons.cc. This is another domain being used as a name server by the Russian Business Network (RBN) according to Emerging Threat's RBN IP monitoring list. A quick google search on ringtons.cc shows plenty of cyber criminal activity, so lets dive right into this domain's whois information -
Domain Name: RINGTONS.CC
Registrar: KEY-SYSTEMS GMBH
Whois Server: whois.rrpproxy.net
Referral URL: http://www.key-systems.net
Name Server: NS1.RINGTONS.CC
Name Server: NS2.RINGTONS.CC
Name Server: NS3.RINGTONS.CC
Status: ACTIVE
Updated Date: 11-jan-2011
Creation Date: 11-jan-2011
Expiration Date: 11-jan-2012
DOMAIN: RINGTONS.CC
owner-contact: P-MVE719
owner-fname: Mariya
owner-lname: Egorova
owner-street: ul.Petrischeva d.14 kv.560
owner-city: Dzerzhinsk
owner-state: Nizhegorodskaya oblast
owner-zip: 606037
owner-country: RU
owner-phone: 7.8312951414
owner-fax: 7.8312951414
owner-email: aaron@cheapbox.ru
source: centralops.net
Now, from my initial research I noticed Mariya/Maria kept her whois information pretty consistent. But then there's the phone/fax number +7.8312951414. A quick search to analyze the phone number on International Numbering Plans (link here if you want to analyze it yourself) gives us the following information about the phone number -

Information on phone number range +7 831 2XXXXXX
Number billable as geographic number
Country or destination Russia
City or exchange location Nizhniy Novgorod
Original network provider*

Nizhiniy Nvogorod is where this number should dial to as far as a city, yet where does Mariya claim residence? Dzerzhinsk, that is the first sign of falsified whois with criminal intent. Secondly, we have a legitimate hotel (Hotel Volna) that uses the VERY same phone number (7.8312951414 OR +7 831 295 14 14) as a fax line -
Front office department
booking
Tel. +7 831 295 19 00
Fax +7 831 295 14 14
reception@volnahotel.ru
Address:
98, Pr. Lenina,
Nizhny Novgorod 603004 Russia

Website: http://www.volnahotel.ru/en/about/contacts
Hands down, this shows falsified whois registrant details for criminal intent. In fact, there's two whole pages here of google hits showing the Volna Hotel owns this number. Notice on that last google search how I told google to not show any results that had the term Maria in it (e.g. -Maria)? What happens when I google without the -Maria? We come across a google search front page filled with domains used in fraud and malware dispersal. Suprised? I'm not, we know the whois registrant details have been intentionally falsified for criminal intentions.

So with the whois registrant details proven falsified for ringtons.cc, lets show why they falsified them with a quick google search... also showing how the domain ringtons.cc is being used -

Fraud:
http://db.aa419.org/fakebanksview.php?key=56024
link here (too long)
link here (too long)
http://ddanchev.blogspot.com/2011/01/keeping-money-mule-recruiters-on-short.html
http://forum.419eater.com/forum/viewtopic.php?t=198424&view=next
http://www.fraudwatchers.org/forums/archive/index.php/t-39271-p-3.html

Malware:
http://amada.abuse.ch/?search=lilac-groupllc.cc
link here (too long)
http://support.clean-mx.de/clean-mx/viruses.php?domain=fintec-ltd.cc&sort=first%20desc

Again, there were pages of examples showing how the domain ringtons.cc is being used as a name server to promote fraud and malware attacks. Why put them all here though, we've proven beyond a shadow of a doubt that the true owner of ringtons.cc (the RBN) is using the domain to spread their cyber crime. We've also shown that their whois registrant details have been intentionally falsified for these illegal purposes. KEY-SYSTEMS GMBH helped register it, they should clean it up by placing the domain on ClientHold.

In fact, Key-Systems you should probably check your registry to see if the same person, via any of the details they gave you when registering ringtons.cc, have registered other sites with your registrar services. If they have, save yourself the time and headache and just place all of their domains on client hold.

pageredns.cc

Continuing down the list of name servers I mentioned towards the bottom of my first blog post, time to take a look at pageredns.cc. This is another domain acting as a name server for the Russian Business Network according to Emerging Threat's RBN IP/NS monitoring list. Seeing as how the RBN "is a multi-faceted cybercrime organization specializing in and in some cases monopolizing personal identity theft for resale," it would make sense that the whois registrant details have been falsified both intentionally and for criminal purpose (a quick google on pageredns.cc shows plenty of criminal purpose). Diving right in -
Domain Name: PAGEREDNS.CC
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.PAGEREDNS.CC
Name Server: NS2.PAGEREDNS.CC
Name Server: NS3.PAGEREDNS.CC
Status: CLIENT-XFER-PROHIBITED
Updated Date: 11-jan-2011
Creation Date: 11-jan-2011
Expiration Date: 11-jan-2012
Registrant Contact:
   Ilya Anisimov
   Ilya Anisimov ()
   
   Fax: 
   ul.Pronina d.26 kv.20
   Kandalaksha, Murmanskaya obl 184040
   RU

Administrative Contact:
   Ilya Anisimov
   Ilya Anisimov (freer@free-id.ru)
   +7.8152628111
   Fax: +7.8152628111
   ul.Pronina d.26 kv.20
   Kandalaksha, Murmanskaya obl 184040
   RU
Source: centralops.net
A quick search on Anisimov's street address shows plenty of cyber crime ranging from fake pharmacy/fraud domains to sites used to spread malware. Evidently, Anisimov is no stranger to cyber crime. So what does a quick google search on Ilya's phone number show (+7.8152628111 OR +78152628111)? Nothing much, we see the whois registrant details staying very consistent. Even searching Ilya's email address (freer@free-id.ru) doesn't return anything. It looks like we're going to have to analyze the whois registrant details the hard way, address analysis.

Let's hop over to google maps and see what we can find. Out first hint comes from google maps here. The street name Pronina (Russian: Пронина and roughly translated to English as Pronin to be accutrate) does exist. So the street address in Russian would be as follow -
26, ул. Пронина, пом. 20
Кандалакша, Мурманская обл., 
Russia, 184040
Here's the problem, Google maps can't find that address even if I remove the apartment number (пом. 20). This suggests the address is non-existent. Taking this even further to show that 26 ulista (Russian for street) Pronina doesn't exists, I googled it. Nothing, nada, not a single hit found. Taking this one step further, lets see if we can find a street map or address finder for the city of Kandalaksha. What is funny is mapquest seems to work for Russia, and it can't find this address. It would be nice to have a GIS (geographical informations system) on Russia's streets publicly available, but for now google maps will have to do here. Needless to say, this address has trouble claiming existence anywhere else other than the whois registrant details on sites set up to serve malware and commit acts of fraud.

Not entirely shocking as this is the RBN and that is their bread and butter. They will falsify whois details and be involved in domains/name servers that are involved in cyber crime. The fact that pageredns.cc is acting as a name server for the RBN and that it's whois registrant details are (at best) intentionally shady is just part of the game. So let's see how the RBN is using pageredns.cc as a domain/name server with a quick google search -

Fraud:
http://db.aa419.org/fakebanksview.php?key=56024
Link here (too long)
http://forum.419eater.com/forum/viewtopic.php?p=1665521
http://www.delphifaq.com/faq/scams/f1057.shtml?p=70
http://www.fraudwatchers.org/forums/showthread.php?p=127376

Malware:
http://amada.abuse.ch/?search=lilac-groupllc.cc
http://support.clean-mx.de/clean-mx/viruses.php?domain=throne-groupllc.cc&sort=first%20desc
http://forum.autosec4u.info/showthread.php?tid=3708 (German: possible ZeuS trojan activity)

There were plenty of other abuse links found, but point in case pageredns.cc is using intentionally falsified whois registrant information for criminal purposes. Granted, it's not easy to spot... but given the level of criminal activity on the domain/name server pageredns.cc, it merits investigation. Given the fact that it ties in with further abuse here and here (tied in with AUSTDEC.CC & OLIVAU.CC), we can safely assume that not only has Enom received falsified whois registrant information but that pageredns.cc is tied in to the same money mule recruitment gang I mentioned in my first blog post.

Enom, do yourself a favor and get rid of any domain using the same whois information used to register pageredns.cc. It will save you a lot of time and headaches.

OLIVAU.CC

Continuing on from my first blog post, time to look at the Russian Business Network's (RBN) domain/name server OLIVAU.CC. Unfortunately, OLIVAU.CC is not listed in Emerging Threat's RBN IP monitoring list. However, due to the fact that it is being used by the same money mule recruitment gang I noted in my first post, and a quick google search on this domain returns a full page of nothing but fraud and malware hits... it's safe to assume we are talking about the same cyber crime friendly host. Diving right in, lets check out the whois registrant information -

Domain Name: OLIVAU.CC
Registrar: ENOM, INC.
Whois Server: whois.enom.com
Referral URL: http://www.enom.com
Name Server: NS1.OLIVAU.CC
Name Server: NS2.OLIVAU.CC
Name Server: NS3.OLIVAU.CC
Status: CLIENT-XFER-PROHIBITED
Updated Date: 20-feb-2011
Creation Date: 17-dec-2010
Expiration Date: 17-dec-2011

Registrant Contact:
   Larisa Kornyakova
   Larisa Kornyakova ()
   
   Fax: 
   pr-kt Kosmonavtov d.1B kv.80
   Korolev, Moskovskaya oblast 141075
   RU

Administrative Contact:
   Larisa Kornyakova
   Larisa Kornyakova (bop@cheapbox.ru)
   +7.4957284001
   Fax: +7.4957284001
   pr-kt Kosmonavtov d.1B kv.80
   Korolev, Moskovskaya oblast 141075
   RU
Source: centralops.net
Larisa Kornyakova, a quick google search on his/her registrant street address returns nothing but fake pharmacy/software sites and malware hits. How much would you bet the registrant address is falsified? Proving so, let's google Larisa's phone number (+7.4957284001 OR +74957284001). Sifting through the results, this was easy enough -
Domain name: pillsmedspharmacypractitioners.com
Registrant Contact: Vladimir Dudnik
Vladimir Dudnik belch@ca4.ru
+74957284001 fax: +74957284001
ul.Lenina d.99a kv.45
Kolomna Moskovskaya obl 140411 RU
Created: 2010-12-14 Expires: 2011-12-14
Source: http://pillsmedspharmacypractitioners.com.w3spy.net/
We have a fake pharmacy site, created in December of 2010 (just like OLIVAU.CC), using the same registrant phone number as OLIVAU.CC. Notice we have a totally different registrant name and address though than OLIVAU.CC! This is hands down, intentionally falsified whois registrant information for criminal purposes (why else would the RBN do this if not for criminal reasons). Vladimir is also found here registering another site (coo0lnet.net) in September of 2010 (e.g. 2 months before OLIVAU.CC was registered) with the same registrant details he used on pillsmedspharmacypractitioners.com . Funny thing about coo0lnet.net, it's listed by McAfee site advisor as a website used to disperse malware. In fact, you can see more of Vladimir using the same phone number OLIVAU.CC used in registrant details here, here, here, here, and here for other domains used in fraud or to spread malware.

Still think this doesn't prove falsified whois registrant information on OLIVAU.CC? Well we aim to please, serve, and prove here. Moving on to sample #2 -
Domain Name: JAPANHOMESTORE.COM
Registrant:
    Alexander Zolotov
    Alexander Zolotov   (ft@bigmailbox.ru)
    ul. Akademika Anohina d.13 kv.244
    Moskva
    Moskva,119571
    RU
    Tel. +7.4957284001
    Fax. +7.4957284001

Creation Date: 10-Feb-2010  
Expiration Date: 10-Feb-2011 

Source: http://www.who.is/whois/japanhomestore.com/
Look at that! It's the same phone number used to register OLIVAU.CC (by Larisa Kornyakova) and all of Vladimir Dudnik's domains... and they're all registered during the year of 2010! That time line has trouble supporting the fact that the registrant information is legitimate, as we now have 3 different names for one phone number and 3 different addresses! So what was the domain JAPANHOMESTORE.COM? It's just a website used to spam and scam. Looks like Alexander Zolotov isn't anyone you would want to do business with. In fact, you can see some of Alex's other site's whois details here (fake pharmacy), here (fake phramacy), here (scam), and here (another fake phramacy). 


With all of the above stated, it has been shown the whois registrant details on OLIVAU.CC have been falsified intentionally and with criminal intent. So lets show how the domain OLIVAU.CC is being used as a name server for more cyber crime with a quick google search


Fraud:
http://scamfraudalert.wordpress.com/2011/01/31/money-visual-llc-money-visualuk-cc/
http://scamfraudalert.wordpress.com/2011/01/14/high-tech-world-ltd/
http://scamfraudalert.wordpress.com/2011/01/12/avon-products-plc-journey-financial-cc/
http://ddanchev.blogspot.com/2011/01/keeping-money-mule-recruiters-on-short.html
http://www.delphifaq.com/faq/scams/f1057.shtml?p=68


Malware: 
Web Cache link (from clean-mx.de)
http://amada.abuse.ch/?search=duncroft-group-inc.cc
http://amada.abuse.ch/?search=gogo-group-inc.cc
Web Cache link (from clean-mx.de)


There were plenty of other hits on google for the cyber crime OLIVAU.CC is helping to promote as a domain/name server for the Russian Business Network. No need to list them all, but for the last little bit I will talk about this. Enom, being the registrar of this site, did a major "fail" here when it comes to checking whois registrant information. It always amazes me how activity on a domain live OLIVAU.CC can go on for so long without anyone in the registrar industry even hearing about it. 


Enom, that's strike two for you on my blog spot. The first strike was AUSTDEC.CC, you can read more about it here. In fact you may want to read my first blog post and take note of the name server section I mentioned at the very bottom of that post. I'll be going through each domain I mentioned as acting as a name server in that post. Save your abuse staff the time and see if any more of those domains I listed are apart of your registry. You may even think about deleting the same Larisa Kornyakova/Vladimir Dudnik/Alexander Zolotov I mentioned in this post from your registry entirely. It would save you one big headache.